Main menu

Feds charge three in largest email data breach in U.S. history

Three men are accused of stealing more than one billion email addresses from email service providers in what the U.S. Department of Justice is calling the largest data breach in U.S. history.

Two Vietnamese men living in the Netherlands and one Canadian man were indicted Thursday for the data breach and the subsequent profits reaped from the act,a release from the department read.

“These men — operating from Vietnam, the Netherlands, and Canada — are accused of carrying out the largest data breach of names and email addresses in the history of the Internet,” said Assistant Attorney General Caldwell. “The defendants allegedly made millions of dollars by stealing over a billion email addresses from email service providers. This case again demonstrates the resolve of the Department of Justice to bring accused cyber hackers from overseas to face justice in the United States.”

According to the indictments, Viet Quoc Nguyen, 28, of Vietnam, allegedly hacked into at least eight email service providers and stole more than one billion email addresses between February 2009 and June 2012. He, along with Giang Hoang Vu, 25, also of Vietnam, then allegedly sent spam emails to tens of millions of the addresses.

David-Manuel Santos Da Silva, 33, of Montreal, Canada, then allegedly helped the other two men generate revenue from the visits to websites linked in the spam emails. He was indicted for conspiracy to commit money laundering.

“This case reflects the cutting-edge problems posed by today’s cybercrime cases, where the hackers didn’t target just a single company; they infiltrated most of the country’s email distribution firms,” said Acting U.S. Attorney John A. Horn. “And the scope of the intrusion is unnerving, in that the hackers didn’t stop after stealing the companies’ proprietary data — they then hijacked the companies’ own distribution platforms to send out bulk emails and reaped the profits from email traffic directed to specific websites.”

Dutch law enforcement officials arrested Vu in 2012 and he was extradited to the United States in March 2014. He pleaded guilty to conspiracy to commit computer fraud Feb. 5. He is scheduled to be sentenced April 21.

Da Silva was arrested Feb. 12 at Fort Lauderdale International Airport and was scheduled to be arraigned Friday. The Justice Department considers Nguyen to be a fugitive.